Overriding WS-Federation token lifetime in Thinktecture IdentityModel

As I described earlier, you can configure the default session token lifetime. One detail I didn’t mention was that with the technique I illustrated you can only make the session lifetime shorter than the original token lifetime, but not longer. The point of this post is to show how you can make the session token lifetime longer than the token issued from a STS.

Once the FAM (federated authentication module) receives a token and then issues a session security token, it raises a SessionSecurityTokenCreated event. It is at this point where you can configure aspects of the token. Unfortunately the expiration isn’t something you can set, but you can designate a different session security token essentially replacing the the one created by the FAM. Here’s how (assuming the event handler in global.asax):

void WSFederationAuthenticationModule_SessionSecurityTokenCreated(object sender, SessionSecurityTokenCreatedEventArgs e)
{
    var handler = (SessionSecurityTokenHandler)FederatedAuthentication.FederationConfiguration.IdentityConfiguration.SecurityTokenHandlers[typeof(SessionSecurityToken)];
    var duration = handler.TokenLifetime;

    var token = e.SessionToken;
    e.SessionToken =
        new SessionSecurityToken(
            token.ClaimsPrincipal,
            token.Context,
            token.ValidFrom,
            token.ValidFrom.Add(duration))
        {
            IsPersistent = token.IsPersistent,
            IsReferenceMode = token.IsReferenceMode
        };
}

This code creates a new session security token (like described here) and it uses the duration as configured on the session security token handler (like described here). As with many of these behaviors, it’s not hard to configure in an application but it’s tedious. As such, this feature was added to the Thinktecture IdentityModel security library via the OverrideWSFedTokenLifetime API. It would typically be used in conjunction with setting the default session security token duration (like described here):

public override void Init()
{
    PassiveModuleConfiguration.OverrideWSFedTokenLifetime();
}

HTH